Malware Report

This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection.

Malware Search Criteria:

MD5 =f5b373648b2502bcb54abfb5aaf48b25

File MD5Sum	SHA1SUM	SHA256SUM	FUZZY HASH	File Size
f5b373648b2502bcb54abfb5aaf48b25	9349660e5d2fc793a5a9ea837363453c023584c0	b2557e50330e243caadaf7659f13b145df907d663a32c571e854214233999252	6144:c0CvZTJ/KX39zucJXCd6eEpWuJw8lFCEOxICGPZuEF5:6Z9/KHQiX6EpWu9dp7PZuC	305664

File Name
install%5Fflash%5Fplayer.exe

Snort Class	Snort Alert	Count
A Network Trojan was Detected	ET USER_AGENTS Spoofed MSIE 8 UAS Likely Ponmocup	2
A Network Trojan was Detected	ET CURRENT_EVENTS SEO FAKE AV Win32.Ponmocup Checkin	2

Path	Folder Name

Path	File Name
c:/Documents and Settings/dmc73144/Local Settings/Temp	~unins5375.bat
c:/Documents and Settings	dmc73144xplore.exe
c:/WINDOWS/Prefetch	IPCONFIG.EXE-2395F30B.pf
c:/WINDOWS/Prefetch	MSXBDE40W.EXE-21BF66DA.pf
c:/WINDOWS/Prefetch	NTVDM.EXE-1A10A423.pf
c:/WINDOWS/Prefetch	SANDNET.EXE-2012C478.pf
c:/WINDOWS/system32	msxbde40W.exe
c:	netstat_post.txt
c:	taskv_post.txt

Action	Path	File Name

Action	Path	File Name
modified	c:/Documents and Settings/dmc73144/Cookies	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/History/History.IE5	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5	index.dat
modified	c:/Documents and Settings/dmc73144	NTUSER.DAT
modified	c:/Documents and Settings/dmc73144	ntuser.dat.LOG
modified	c:/WINDOWS/Prefetch	CMD.EXE-087B4001.pf
modified	c:/WINDOWS/Prefetch	HSTART.EXE-221D72BF.pf
modified	c:/WINDOWS/Prefetch	NETSTAT.EXE-2B2B4428.pf
modified	c:/WINDOWS/Prefetch	SH.EXE-00254D2B.pf
modified	c:/WINDOWS/Prefetch	SLEEP.EXE-094A3D2A.pf
modified	c:/WINDOWS/Prefetch	SSHD.EXE-298CA236.pf
modified	c:/WINDOWS/Prefetch	SWITCH.EXE-0496EC21.pf
modified	c:/WINDOWS/system32/config	software
modified	c:/WINDOWS/system32/config	software.LOG
modified	c:/WINDOWS/system32/config	system.LOG
modified	c:/WINDOWS/system32/drivers/etc	hosts
modified	c:/WINDOWS/system32/wbem/Logs	wmiprov.log
modified	c:/WINDOWS/system32/wbem/Repository/FS	INDEX.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING.VER
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING2.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	OBJECTS.MAP

Action	Path

Action	Path	Val_Name	Val_Data

Action	Path	Val_Name	Val_Type	Mod_Val_Type	Val_Data	Mod_Val_Data

Action	Path	Val_Name	Val_Data	Mod_Val_Data
modified	HKLM/SOFTWARE/Microsoft/Cryptography/RNG	Seed	02 FC 40 AA 30 30 64 D5 E4 D3 13 9B 2A A5 8C 50 0D 3C E4 18 88 51 5C D7 2A 43 B9	0A 20 85 F2 F1 1F 76 77 5F 35 57 42 2F A9 9F DA 46 5A 42 70 BE A3 B1 1C 7D CA 1
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet Settings/Connections	SavedLegacySettings	3C 00 00 00 15 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00	3C 00 00 00 17 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/SessionInformation	ProgramCount	0x00000002	0x00000003

DNS	DNS Response
ultrafastsearch.com	Standard query response A 95.211.8.195
imagehut4.cn	Standard query response A 64.158.56.57 A 63.251.179.57

DstIP	HTTP_HOST	HTTP_REQUEST_URI	HTTP_USER_AGENT	PROTOCOL
64.158.56.57	imagehut4.cn	/update/utu.dat	Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; SV1)	0x06
239.255.255.250	239.255.255.250:1900	*	--blank--	0x11

PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
6	15	12	3357	1545
17	2	0	350	0

DPORT	PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
80	6	15	12	3357	1545
1900	17	2	0	350	0

Time	Date	Protocol	SrcIP	DstIP	Dir	Flags	Sport	Dport	Pkts	Bytes
05:02:08	2011-06-26	6	10.10.10.7	95.211.8.195	->	e	108	80	9	1752
05:02:10	2011-06-26	6	10.10.10.7	95.211.8.195	->	e	316	80	9	2218
05:02:11	2011-06-26	6	10.10.10.7	64.158.56.57	->	e	311	80	9	932
05:07:45	2011-06-26	17	10.10.10.7	239.255.255.250	->	e	8	1900	2	350

Packer Name

Honey Trap Log File Location

PTFB Log File Location